“Attacks like these are seldom carried out by compromising the source code directly, but are more often the result of compromised credentials that are then used to publish a malicious version.”
npm now lets you sign a provenance statement linking a package to the commit and build that produced it. It only works if you build on a supported cloud CI, and today that list is GitHub Actions. The flag is opt-in, so the abandoned packages that get hijacked will never use it. Microsoft fixes the supply chain by routing it through Microsoft.